Edit tour

Windows Analysis Report
PO_7413.exe

Overview

General Information

Sample Name:	PO_7413.exe
Analysis ID:	830617
MD5:	1b3b644b48693ffea0d42032e778906b
SHA1:	2a26e739cae611522e94853194499765aa7ba30c
SHA256:	79bcc176d961b06ff3f7af0000c16e8fae56cf03b504153e439ecbccfaa34bbf
Tags:	agentteslaexe
Infos:

Detection

AgentTesla, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected zgRAT

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

PO_7413.exe (PID: 3084 cmdline: C:\Users\user\Desktop\PO_7413.exe MD5: 1B3B644B48693FFEA0D42032E778906B)

PO_7413.exe (PID: 6100 cmdline: C:\Users\user\Desktop\PO_7413.exe MD5: 1B3B644B48693FFEA0D42032E778906B)

PO_7413.exe (PID: 4636 cmdline: C:\Users\user\Desktop\PO_7413.exe MD5: 1B3B644B48693FFEA0D42032E778906B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
zgRAT		No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.printshopgt.com", "Username": "recepcion@printshopgt.com", "Password": "R3cGT17*"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO_7413.exe PID: 4636	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO_7413.exe PID: 4636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PO_7413.exe.378e940.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.PO_7413.exe.378e940.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x70b4b:$s1: file:/// 0x70a5b:$s2: {11111-22222-10009-11112} 0x70adb:$s3: {11111-22222-50001-00000} 0x700dd:$s4: get_Module 0x70368:$s5: Reverse 0x14b5c0:$s5: Reverse 0x6e1f4:$s6: BlockCopy 0x14cc43:$s6: BlockCopy 0x14b766:$s7: ReadByte 0x70b5d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 66.96.134.29

Timestamp:	192.168.2.566.96.134.29496905872839723 03/20/23-14:47:40.789390
SID:	2839723
Source Port:	49690
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 66.96.134.29

Timestamp:	192.168.2.566.96.134.29496905872851779 03/20/23-14:47:40.789531
SID:	2851779
Source Port:	49690
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 66.96.134.29

Timestamp:	192.168.2.566.96.134.29496905872840032 03/20/23-14:47:40.789531
SID:	2840032
Source Port:	49690
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 66.96.134.29

Timestamp:	192.168.2.566.96.134.29496905872030171 03/20/23-14:47:40.789390
SID:	2030171
Source Port:	49690
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PO_7413.exe	ReversingLabs: Detection: 30%
Source: PO_7413.exe	Virustotal: Detection: 40%			Perma Link

Machine Learning detection for sample

Source: PO_7413.exe

Joe Sandbox ML: detected

Source: 2.2.PO_7413.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.PO_7413.exe.378e940.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.printshopgt.com", "Username": "recepcion@printshopgt.com", "Password": "R3cGT17*"}

Source: PO_7413.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO_7413.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WXNg.pdbSHA256O source: PO_7413.exe
Source:	Binary string: WXNg.pdb source: PO_7413.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49690 -> 66.96.134.29:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49690 -> 66.96.134.29:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49690 -> 66.96.134.29:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49690 -> 66.96.134.29:587

Source: Joe Sandbox View

ASN Name: BIZLAND-SDUS BIZLAND-SDUS

Source: global traffic

TCP traffic: 192.168.2.5:49690 -> 66.96.134.29:587

Source: global traffic

TCP traffic: 192.168.2.5:49690 -> 66.96.134.29:587

Source: PO_7413.exe, 00000000.00000003.309795226.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309639619.0000000005740000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309866819.0000000005743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.wikip
Source: PO_7413.exe, 00000000.00000003.306402390.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306465269.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306497370.0000000005742000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306380254.0000000005742000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306358175.0000000005743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.wu
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO_7413.exe, 00000002.00000002.573339941.00000000029D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.printshopgt.com
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313041787.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312856168.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: PO_7413.exe, 00000000.00000003.312919072.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313041787.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312856168.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comJl
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comand
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comen
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comms
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.compef
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comr
Source: PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coms
Source: PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314590924.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314060524.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com7
Source: PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comB.TTF
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsF
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd%
Source: PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdTTF
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314060524.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comeded
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlic
Source: PO_7413.exe, 00000000.00000003.321613204.0000000005720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlvfet
Source: PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: PO_7413.exe, 00000000.00000003.321613204.0000000005720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commK
Source: PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsiva7
Source: PO_7413.exe, 00000000.00000003.309091289.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307673660.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307412713.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308652862.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308603977.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308204869.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308127982.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308409074.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307090748.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307291691.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308973363.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308162888.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309149145.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307957109.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308292309.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308917042.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308460070.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307145904.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308862175.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307814144.000000000575F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310155887.000000000572D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO_7413.exe, 00000000.00000003.310287732.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310370311.0000000005740000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310481524.0000000005743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO_7413.exe, 00000000.00000003.309955974.0000000005723000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309839200.0000000005722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cns
Source: PO_7413.exe, 00000000.00000003.309795226.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309866819.0000000005743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cntyp
Source: PO_7413.exe, 00000000.00000003.314864766.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314864766.000000000573A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO_7413.exe, 00000000.00000003.314864766.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/g
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO_7413.exe, 00000000.00000003.314864766.000000000573A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/x
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/7
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/K
Source: PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/T
Source: PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/e
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/T
Source: PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/o
Source: PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/on
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/roso
Source: PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313437350.0000000005735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: PO_7413.exe, 00000000.00000003.314712938.000000000572A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO_7413.exe, 00000000.00000003.306497370.000000000573B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.come
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO_7413.exe, 00000000.00000003.313407677.0000000005728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.coms
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309358449.0000000000B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO_7413.exe, 00000000.00000003.310758013.000000000575F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO_7413.exe, 00000000.00000003.314488615.000000000572C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: mail.printshopgt.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO_7413.exe.378e940.4.raw.unpack, type: UNPACKEDPE

Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO_7413.exe

Source: PO_7413.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.PO_7413.exe.378e940.4.raw.unpack, type: UNPACKEDPE

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 0_2_00A9C1E4	0_2_00A9C1E4
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 0_2_00A9E620	0_2_00A9E620
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 0_2_00A9E630	0_2_00A9E630
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_00CEA958	2_2_00CEA958
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_00CEC918	2_2_00CEC918
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_00CE9D40	2_2_00CE9D40
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_00CEA088	2_2_00CEA088
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_00CE5A02	2_2_00CE5A02
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CF0040	2_2_05CF0040
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CFBB90	2_2_05CFBB90
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CF5290	2_2_05CF5290
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CF6660	2_2_05CF6660
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_0600B5E0	2_2_0600B5E0
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06004BA4	2_2_06004BA4
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06000040	2_2_06000040
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06003AC7	2_2_06003AC7
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06003AD0	2_2_06003AD0
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06006BC0	2_2_06006BC0
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_06000030	2_2_06000030
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_0600E158	2_2_0600E158

Source: PO_7413.exe, 00000000.00000002.336165397.000000000364A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000000.304081466.00000000000F4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWXNg.exe, vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.352280355.00000000070D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.350412716.00000000056E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.336165397.00000000039CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee4ad9a59-b33d-4d55-a700-559a300ec7fa.exe4 vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.336165397.0000000003469000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.328662557.000000000249B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs PO_7413.exe
Source: PO_7413.exe, 00000000.00000002.328662557.000000000249B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee4ad9a59-b33d-4d55-a700-559a300ec7fa.exe4 vs PO_7413.exe
Source: PO_7413.exe, 00000002.00000002.570305709.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO_7413.exe
Source: PO_7413.exe, 00000002.00000002.569046949.0000000000958000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO_7413.exe
Source: PO_7413.exe, 00000002.00000002.568899826.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee4ad9a59-b33d-4d55-a700-559a300ec7fa.exe4 vs PO_7413.exe
Source: PO_7413.exe	Binary or memory string: OriginalFilenameWXNg.exe, vs PO_7413.exe

Source: PO_7413.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO_7413.exe	ReversingLabs: Detection: 30%
Source: PO_7413.exe	Virustotal: Detection: 40%

Source: PO_7413.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO_7413.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe
Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe
Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe
Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_7413.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_7413.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_7413.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@1/1

Source: PO_7413.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\PO_7413.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Mutant created: \Sessions\1\BaseNamedObjects\ryXTJdrlWpWbGOmNsq

Source: C:\Users\user\Desktop\PO_7413.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO_7413.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO_7413.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PO_7413.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WXNg.pdbSHA256O source: PO_7413.exe
Source:	Binary string: WXNg.pdb source: PO_7413.exe

Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CF79AF push edi; iretd		2_2_05CF79B2
Source: C:\Users\user\Desktop\PO_7413.exe	Code function: 2_2_05CF9EA0 pushfd ; ret		2_2_05CF9EA1

Source: PO_7413.exe

Static PE information: 0xE7AB8A5F [Sun Mar 1 20:49:35 2093 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.880495014103316

Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_7413.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO_7413.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO_7413.exe TID: 4692	Thread sleep time: -40023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 4924	Thread sleep count: 4139 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99616s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99243s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -99111s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -97843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe TID: 1236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Window / User API: threadDelayed 4139

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO_7413.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO_7413.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 40023	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99843	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99616	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99483	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99373	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99243	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 99111	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98779	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98171	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 97843	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PO_7413.exe, 00000002.00000002.570305709.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllro

Source: C:\Users\user\Desktop\PO_7413.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO_7413.exe

Memory written: C:\Users\user\Desktop\PO_7413.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe			Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Process created: C:\Users\user\Desktop\PO_7413.exe C:\Users\user\Desktop\PO_7413.exe			Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Users\user\Desktop\PO_7413.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Users\user\Desktop\PO_7413.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\PO_7413.exe

Code function: 2_2_00CEF670 GetUserNameW,

2_2_00CEF670

Stealing of Sensitive Information

Yara detected zgRAT

Source: Yara match

File source: 0.2.PO_7413.exe.378e940.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Source: Yara match	File source: 00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_7413.exe PID: 4636, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO_7413.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PO_7413.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO_7413.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PO_7413.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_7413.exe PID: 4636, type: MEMORYSTR

Remote Access Functionality

Yara detected zgRAT

Source: Yara match

File source: 0.2.PO_7413.exe.378e940.4.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Source: Yara match	File source: 00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_7413.exe PID: 4636, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	114 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO_7413.exe	31%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
PO_7413.exe	40%	Virustotal		Browse
PO_7413.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.PO_7413.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comen	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fontbureau.comalsF	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/roso	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/7	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comB.TTF	0%	URL Reputation	safe
http://www.founder.com.cn/cns	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/T	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fontbureau.com7	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sajatypeworks.come	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.compef	0%	URL Reputation	safe
http://www.fontbureau.comeded	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/T	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/K	0%	URL Reputation	safe
http://www.carterandcone.comr	0%	URL Reputation	safe
http://www.fontbureau.commK	0%	URL Reputation	safe
http://www.fontbureau.comlic	0%	URL Reputation	safe
http://www.carterandcone.coms	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.comd%	0%	Avira URL Cloud	safe
http://www.sakkal.coms	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/x	0%	Avira URL Cloud	safe
http://www.carterandcone.comms	0%	Avira URL Cloud	safe
http://en.wu	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/g	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/on	0%	URL Reputation	safe
http://en.wikip	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.fontbureau.comdTTF	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/o	0%	URL Reputation	safe
http://www.fontbureau.comlvfet	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/e	0%	URL Reputation	safe
http://www.fontbureau.comsiva7	0%	Avira URL Cloud	safe
http://www.carterandcone.comand	0%	URL Reputation	safe
http://mail.printshopgt.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cntyp	0%	Avira URL Cloud	safe
http://www.carterandcone.comJl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.printshopgt.com	66.96.134.29	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.comen	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd%	PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	PO_7413.exe, 00000000.00000003.310758013.000000000575F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313041787.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312856168.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalsF	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/roso	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/7	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.coms	PO_7413.exe, 00000000.00000003.313407677.0000000005728000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comB.TTF	PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cns	PO_7413.exe, 00000000.00000003.309955974.0000000005723000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309839200.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/x	PO_7413.exe, 00000000.00000003.314864766.000000000573A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/.	PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comms	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://en.wu	PO_7413.exe, 00000000.00000003.306402390.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306465269.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306497370.0000000005742000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306380254.0000000005742000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.306358175.0000000005743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	PO_7413.exe, 00000000.00000003.309091289.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307673660.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307412713.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308652862.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308603977.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308204869.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308127982.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308409074.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307090748.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307291691.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308973363.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308162888.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309149145.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307957109.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308292309.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308917042.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308460070.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307145904.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.308862175.000000000575F000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.307814144.000000000575F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309358449.0000000000B1C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/T	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com7	PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	PO_7413.exe, 00000000.00000003.314488615.000000000572C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.come	PO_7413.exe, 00000000.00000003.306497370.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/g	PO_7413.exe, 00000000.00000003.314864766.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.compef	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314590924.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314060524.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comeded	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313999190.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314060524.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/	PO_7413.exe, 00000000.00000003.314864766.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314864766.000000000573A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/T	PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/K	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comr	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commK	PO_7413.exe, 00000000.00000003.321613204.0000000005720000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comlic	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coms	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/on	PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.wikip	PO_7413.exe, 00000000.00000003.309795226.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309639619.0000000005740000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309866819.0000000005743000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comsiva7	PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	PO_7413.exe, 00000000.00000003.310287732.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310370311.0000000005740000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310481524.0000000005743000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.printshopgt.com	PO_7413.exe, 00000002.00000002.573339941.00000000029D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	PO_7413.exe, 00000000.00000002.350675185.0000000006932000.00000004.00000800.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.310155887.000000000572D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/x	PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313437350.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/s	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comdTTF	PO_7413.exe, 00000000.00000003.313872425.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.	PO_7413.exe, 00000000.00000003.314712938.000000000572A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/o	PO_7413.exe, 00000000.00000003.313331989.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comlvfet	PO_7413.exe, 00000000.00000003.321613204.0000000005720000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comm	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314250685.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314133005.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	PO_7413.exe, 00000000.00000003.312621841.0000000005736000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	PO_7413.exe, 00000000.00000002.350675185.0000000006A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comals	PO_7413.exe, 00000000.00000003.314396930.0000000005735000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314488615.0000000005739000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.314315988.0000000005735000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/e	PO_7413.exe, 00000000.00000003.313176984.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312826759.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312890011.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312706788.000000000573B000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312994530.000000000573B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comJl	PO_7413.exe, 00000000.00000003.312919072.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.313041787.0000000005722000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.312856168.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comand	PO_7413.exe, 00000000.00000003.312009586.0000000005722000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cntyp	PO_7413.exe, 00000000.00000003.309795226.0000000005743000.00000004.00000020.00020000.00000000.sdmp, PO_7413.exe, 00000000.00000003.309866819.0000000005743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.96.134.29	mail.printshopgt.com	United States		29873	BIZLAND-SDUS	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830617
Start date and time:	2023-03-20 14:46:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	PO_7413.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 39 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:47:25	API Interceptor	19x Sleep call for process: PO_7413.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIZLAND-SDUS	Q5QuwXOwrT.elf	Get hash	malicious	Mirai	Browse	209.40.194.212
	Inquiry.exe	Get hash	malicious	FormBook	Browse	66.96.161.158
	ye5GHWJ8UG.exe	Get hash	malicious	Grandcrab, Gandcrab	Browse	66.96.147.106
	Inquiry.exe	Get hash	malicious	FormBook	Browse	66.96.161.158
	SWIFT_Transfer.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.155
	3004566.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	66.96.163.136
	gjvkyygg.exe	Get hash	malicious	FormBook	Browse	66.96.160.138
	Cotizaci#U00f3n_0595.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	66.96.160.155
	rConsumerPO-4806125050.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.155
	INTHIST_230714122537.vbs	Get hash	malicious	FormBook	Browse	66.96.162.130
	Quotation 37099.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.155
	NSYRmSXD2r.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	66.96.147.104
	T6F1W04v8G.exe	Get hash	malicious	AgentTesla	Browse	66.96.147.104
	sora.arm.elf	Get hash	malicious	Mirai	Browse	209.59.226.169
	https://go2.israelandafrica.com/f/a/y5H0bDO4woHaMQouJjYlOfq~~/OMbOowf~/aHR0cDovL0N1cmF0ZWJpby5VU0VSaEJNWUkubXNibG9nZ2VyLmNvbS5hdS9qYXNvbi53YWxzaEBjdXJhdGViaW8uY29t	Get hash	malicious	Unknown	Browse	207.148.248.132
	fv7YxvEYO7.elf	Get hash	malicious	Mirai	Browse	209.59.226.190
	1jwI8qulgr.exe	Get hash	malicious	FormBook	Browse	66.96.162.147
	Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	FedEx Express AWB#5305323204643.exe	Get hash	malicious	FormBook	Browse	66.96.147.160
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149

Process:	C:\Users\user\Desktop\PO_7413.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8746286820631415
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO_7413.exe
File size:	921600
MD5:	1b3b644b48693ffea0d42032e778906b
SHA1:	2a26e739cae611522e94853194499765aa7ba30c
SHA256:	79bcc176d961b06ff3f7af0000c16e8fae56cf03b504153e439ecbccfaa34bbf
SHA512:	5889b4312b50de48da9e57d0eeba34ffe7f552f9213168e968987150752c353ddf9191b421ef89ec32249002d261f252eb34870320d1cc61b630e8f0102ccad7
SSDEEP:	24576:FKUX6CbNDSMEBscggDeSOrwBNKDAsJvZ:pXZbIXBxeS5BNKr7
TLSH:	4A1502246BEB8326F6365BBD91A12682577E27A37703D68D1CF112CA4727B014FD132B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.................0..............%... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4e25aa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE7AB8A5F [Sun Mar 1 20:49:35 2093 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe2558	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe4000	0x58c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe035c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe05b0	0xe0600	False	0.936121387534819	PGP symmetric key encrypted data - Plaintext or unencrypted data	7.880495014103316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe4000	0x58c	0x600	False	0.4173177083333333	data	4.044715606987517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xe4090	0x2fc	data
RT_MANIFEST	0xe439c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.566.96.134.29496905872839723 03/20/23-14:47:40.789390	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49690	587	192.168.2.5	66.96.134.29
192.168.2.566.96.134.29496905872851779 03/20/23-14:47:40.789531	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49690	587	192.168.2.5	66.96.134.29
192.168.2.566.96.134.29496905872840032 03/20/23-14:47:40.789531	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49690	587	192.168.2.5	66.96.134.29
192.168.2.566.96.134.29496905872030171 03/20/23-14:47:40.789390	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49690	587	192.168.2.5	66.96.134.29

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:47:38.902317047 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.007510900 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.007812023 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.114033937 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.119223118 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.224498987 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.224586964 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.225270033 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.330396891 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.330877066 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.331320047 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.436825037 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.438386917 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.438667059 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.544048071 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.546717882 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:39.546988964 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:39.652383089 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.681462049 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.681699991 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:40.787223101 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.787426949 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.789390087 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:40.789530993 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:40.789588928 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:40.789647102 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:47:40.894815922 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.894861937 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:40.896704912 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:47:41.036768913 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:49:19.270958900 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:49:19.376615047 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:49:19.377424002 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:49:19.377515078 CET	587	49690	66.96.134.29	192.168.2.5
Mar 20, 2023 14:49:19.377933025 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:49:19.380515099 CET	49690	587	192.168.2.5	66.96.134.29
Mar 20, 2023 14:49:19.485925913 CET	587	49690	66.96.134.29	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:47:38.769144058 CET	58218	53	192.168.2.5	8.8.8.8
Mar 20, 2023 14:47:38.882294893 CET	53	58218	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 14:47:38.769144058 CET	192.168.2.5	8.8.8.8	0x699a	Standard query (0)	mail.printshopgt.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 14:47:38.882294893 CET	8.8.8.8	192.168.2.5	0x699a	No error (0)	mail.printshopgt.com		66.96.134.29	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 20, 2023 14:47:39.114033937 CET	587	49690	66.96.134.29	192.168.2.5	220 ESMTP Mon, 20 Mar 2023 09:47:39 -0400: UCE strictly prohibited
Mar 20, 2023 14:47:39.119223118 CET	49690	587	192.168.2.5	66.96.134.29	EHLO 367706
Mar 20, 2023 14:47:39.224586964 CET	587	49690	66.96.134.29	192.168.2.5	250-bosauthsmtp04.yourhostingaccount.com Hello 367706 [84.17.52.9] 250-SIZE 34603008 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-CHUNKING 250-STARTTLS 250 HELP
Mar 20, 2023 14:47:39.225270033 CET	49690	587	192.168.2.5	66.96.134.29	AUTH login cmVjZXBjaW9uQHByaW50c2hvcGd0LmNvbQ==
Mar 20, 2023 14:47:39.330877066 CET	587	49690	66.96.134.29	192.168.2.5	334 UGFzc3dvcmQ6
Mar 20, 2023 14:47:39.438386917 CET	587	49690	66.96.134.29	192.168.2.5	235 Authentication succeeded
Mar 20, 2023 14:47:39.438667059 CET	49690	587	192.168.2.5	66.96.134.29	MAIL FROM:<recepcion@printshopgt.com>
Mar 20, 2023 14:47:39.546717882 CET	587	49690	66.96.134.29	192.168.2.5	250 OK
Mar 20, 2023 14:47:39.546988964 CET	49690	587	192.168.2.5	66.96.134.29	RCPT TO:<recepcion@printshopgt.com>
Mar 20, 2023 14:47:40.681462049 CET	587	49690	66.96.134.29	192.168.2.5	250 Accepted
Mar 20, 2023 14:47:40.681699991 CET	49690	587	192.168.2.5	66.96.134.29	DATA
Mar 20, 2023 14:47:40.787426949 CET	587	49690	66.96.134.29	192.168.2.5	354 Enter message, ending with "." on a line by itself
Mar 20, 2023 14:47:40.789647102 CET	49690	587	192.168.2.5	66.96.134.29	.
Mar 20, 2023 14:47:40.896704912 CET	587	49690	66.96.134.29	192.168.2.5	250 OK id=1peFrQ-00054x-Nh
Mar 20, 2023 14:49:19.270958900 CET	49690	587	192.168.2.5	66.96.134.29	QUIT
Mar 20, 2023 14:49:19.377424002 CET	587	49690	66.96.134.29	192.168.2.5	221 bosauthsmtp04.yourhostingaccount.com closing connection

Target ID:	0
Start time:	14:47:19
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\PO_7413.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO_7413.exe
Imagebase:	0x10000
File size:	921600 bytes
MD5 hash:	1B3B644B48693FFEA0D42032E778906B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	14:47:27
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\PO_7413.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO_7413.exe
Imagebase:	0x80000
File size:	921600 bytes
MD5 hash:	1B3B644B48693FFEA0D42032E778906B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	14:47:27
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\PO_7413.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO_7413.exe
Imagebase:	0x4d0000
File size:	921600 bytes
MD5 hash:	1B3B644B48693FFEA0D42032E778906B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.573339941.0000000002981000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	7

Executed Functions

Function 00A9B750 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A9B7B0
GetCurrentThread.KERNEL32 ref: 00A9B7ED
GetCurrentProcess.KERNEL32 ref: 00A9B82A
GetCurrentThreadId.KERNEL32 ref: 00A9B883

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ab9644347370ff22118eb2f9a1992853587a9661672932282c1affe159436d5
Instruction ID: 25ca2e94945f8dd77a097f2c0099823a52be126ede78027af0f1b9bf1efb7979
Opcode Fuzzy Hash: 7ab9644347370ff22118eb2f9a1992853587a9661672932282c1affe159436d5
Instruction Fuzzy Hash: AC5144B0D006498FDB14CFAADA48B9EBBF0BF88304F248469E019A7360DBB45944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00A9FDB8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A9FECA

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 97b54375c29677a860cc02d3c3151bacc3d3ca166718b32ed84eedf0c8ae9bc9
Instruction ID: d697c482d04b24fde2bf62e3844787598cfa5200b7603c3df1ca5c59e847e673
Opcode Fuzzy Hash: 97b54375c29677a860cc02d3c3151bacc3d3ca166718b32ed84eedf0c8ae9bc9
Instruction Fuzzy Hash: 0141CEB1D003099FDF14CF9AC984ADEBBF5BF48710F24812AE819AB250D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A93DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A95421

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b2b952dafc8518090e090376f1348fc961059518b5f3d6dfd4f5a43f850c79eb
Instruction ID: c4eb8cb079e10b08f9e15a457a8ef05d141023bb7a9dd2061b478667e56225f3
Opcode Fuzzy Hash: b2b952dafc8518090e090376f1348fc961059518b5f3d6dfd4f5a43f850c79eb
Instruction Fuzzy Hash: E341F171D00718CFDB24DFA9C845B9EBBF5BF88704F20806AD408AB251DBB56985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A9536E Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A95421

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 52b3b64e259438bcf4cba043e04de2915d8bd22f7a81f296d2de5aa4dc19cc15
Instruction ID: 08f6dfc75973cef9f2420df71c7d768ef7753d9d9cb9fcf6ba39373a28c83955
Opcode Fuzzy Hash: 52b3b64e259438bcf4cba043e04de2915d8bd22f7a81f296d2de5aa4dc19cc15
Instruction Fuzzy Hash: C841F271D00718CEDB24DFA9C845BCEBBF5BF88704F20806AD418AB251DBB56985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A9B978 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A9B9FF

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 70a421589f2593666ae2b0050d692e8990ec166b7e31026889068bff816f893b
Instruction ID: a75779dd591d99d57ed655a77bb5786865f13bf6fe8f4120c20771a0cdb171b8
Opcode Fuzzy Hash: 70a421589f2593666ae2b0050d692e8990ec166b7e31026889068bff816f893b
Instruction Fuzzy Hash: 2D21B0B59002499FDB10CFAAD984ADEBBF8EB48324F14841AE914A7310D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A99538 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A99A11,00000800,00000000,00000000), ref: 00A99C22

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33274ba205c508ffe06941bea6090b80bb7ef8aff6b038094f86a0ba1d26d161
Instruction ID: c5b2e2d5ba6aa425f86bcc6cd4e62953424700533fdc1a821f2cc1c8c6ce0d59
Opcode Fuzzy Hash: 33274ba205c508ffe06941bea6090b80bb7ef8aff6b038094f86a0ba1d26d161
Instruction Fuzzy Hash: 2111D3B69002099FDF10DF9AD944ADFFBF4EB48720F14846ED415A7600C7B8A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A99930 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A99996

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9a61712f962965e21ddf94dfb79614d23f47bad3e30c7acbf0c25a1e3b8c1d91
Instruction ID: f9c072d153576d9de5ca858f732251c272c237e265c3bcd47dadd2d1f197af2b
Opcode Fuzzy Hash: 9a61712f962965e21ddf94dfb79614d23f47bad3e30c7acbf0c25a1e3b8c1d91
Instruction Fuzzy Hash: B7110FB6D002098FDB10CF9AC544ADEFBF4AB88320F14842ED419B7210C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327007162.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7afc966e9f237c3111b0e2c9db626e4631a3eebd3ab663a68ab6e3312cda31
Instruction ID: d5517bed09768602ea51e08509f89182228779540dd0ba34eb4dded5998315fd
Opcode Fuzzy Hash: 1c7afc966e9f237c3111b0e2c9db626e4631a3eebd3ab663a68ab6e3312cda31
Instruction Fuzzy Hash: 95213771904344DFEB15DF14D9C0B26BF65FB88328F24C569E806CBA46C336D846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327096784.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8bed36a48374bba407417a9a2e38d41b18b54c6b7ebbb35df4a6faccf37da6
Instruction ID: 471040387faf7b3240766443f7331ba3c75240b3a178b551fdaa95b34c996372
Opcode Fuzzy Hash: fc8bed36a48374bba407417a9a2e38d41b18b54c6b7ebbb35df4a6faccf37da6
Instruction Fuzzy Hash: 7921F275604744EFDB14EF14D9C0B56BBA5FB88328F24C9A9D8098B346D33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 008BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327096784.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03246692ade5fdf50316cc4998f65dac7e16ecd4c6d6617eeb5b6a689a981135
Instruction ID: 097dd9bdfe91e6fa3a73baece06acf9cf56e64018ca75129cc953e9fb2733764
Opcode Fuzzy Hash: 03246692ade5fdf50316cc4998f65dac7e16ecd4c6d6617eeb5b6a689a981135
Instruction Fuzzy Hash: 92210475504384EFDB05DF14D9C0B66BBA5FB84318F24CAADE8098B346D33AE846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327096784.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cb30f1c32656761e74edf096eedc134720c3996c0fb8d20c41ce79c00c62ed
Instruction ID: 235777bdeb69c74032b91aaf9f12d53f4201286ed3c330915c132b07f58e6b3e
Opcode Fuzzy Hash: 56cb30f1c32656761e74edf096eedc134720c3996c0fb8d20c41ce79c00c62ed
Instruction Fuzzy Hash: 48217F755087809FCB02DF14D994B11BFB1FB46314F28C5EAD8498B2A6D33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 008AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327007162.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: a3263039c54cba921e421f6928677f9cd22c5d334b0f9354746e791d91f7cf9e
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: 3311E676904380CFDB12CF14D5C4B16BF71FB84324F28C6A9D8458BA56C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327096784.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction ID: 1b0428887442449a7569aa81a1a432ce4515700f92b556eab7cb9259d4578ea1
Opcode Fuzzy Hash: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction Fuzzy Hash: FB117975904280EFDB12CF14D5C4B55BBA2FB84324F28C6A9D8498B756D33AE84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 008AD5D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327007162.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508677dcf753f027aa40af651d0e86b9d4c568b7c523b1f2c12ecf67aedbf99f
Instruction ID: 3efb90ec0ab526d939ef1f7a8493c8c538b79264df7cae914f3c829180702023
Opcode Fuzzy Hash: 508677dcf753f027aa40af651d0e86b9d4c568b7c523b1f2c12ecf67aedbf99f
Instruction Fuzzy Hash: 4901F7724043449AF7104A1ADC84766FFD8FF52734F18855AED0ADAE46C3799840CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 008AD5D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327007162.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ad000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b156abc01a6ab7b7a3a6fca821bebea423251bf65bd96f745ddd4cf7b88ccf46
Instruction ID: 0fa3d03344ac6901088de6fa6cf90032125173e6e4f295ac1344237614043d3f
Opcode Fuzzy Hash: b156abc01a6ab7b7a3a6fca821bebea423251bf65bd96f745ddd4cf7b88ccf46
Instruction Fuzzy Hash: 7CF062724043449EE7108A16DD84B62FFE8EF91734F18C55AED099BA86C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A9E630 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9334d0c3d1e14b7426078fd5f56997371b61ce381212a10b99475fa76c0af07b
Instruction ID: dc83ce4e03449c2faadaf8c7faa54d61fa3cf6a0af19e47ec319b14496715c1b
Opcode Fuzzy Hash: 9334d0c3d1e14b7426078fd5f56997371b61ce381212a10b99475fa76c0af07b
Instruction Fuzzy Hash: 0C12A4F1C11F468AD714CFB6EC9C9893BA1B7553A8B924308E2612A6F0D7B425CBCF44

Uniqueness

Uniqueness Score: -1.00%

Function 00A9C1E4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095cbf25406165f5079ea11b72321fc8cb91c3a800a70456b1b8d301e7b7da4
Instruction ID: 3509a3aa91d81a577aa9b1b3d7121952202e1dd98f0090345c1e4da26d33b0c7
Opcode Fuzzy Hash: 2095cbf25406165f5079ea11b72321fc8cb91c3a800a70456b1b8d301e7b7da4
Instruction Fuzzy Hash: 0CA15D32F0061A8FCF15DFB5C9449DEBBF2FF89300B15856AE805AB261EB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A9E620 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327412564.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1960211f1cfa1e946eb37c7fd115a3baef64666e94869a4662f71daf6a8f004
Instruction ID: 649cf6b2e77e4ba3a7f5e9eeb1b7c5c66c94af6ea452f0e5da319bcc1be6dc68
Opcode Fuzzy Hash: c1960211f1cfa1e946eb37c7fd115a3baef64666e94869a4662f71daf6a8f004
Instruction Fuzzy Hash: 69C106B1C11B468AD714CFB6EC889897BA1BB85364F524309E1616B6F0DBB435CBCF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO_7413.exePID: 4636, Parent PID: 3084COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	144
Total number of Limit Nodes:	7

Executed Functions

Function 00CEF670 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00CEF7AB

Memory Dump Source

Source File: 00000002.00000002.570261312.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_PO_7413.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 311f4350e64bfcafd5d8c87fe73a0f8d6b4efa4023b0fa8c33c0fe3670544149
Instruction ID: 7e40d2805d5e0cf53c931aa973ef0aa005362889b89b0df1880b3ecbd23368b6
Opcode Fuzzy Hash: 311f4350e64bfcafd5d8c87fe73a0f8d6b4efa4023b0fa8c33c0fe3670544149
Instruction Fuzzy Hash: 11512575D002588FDB14CFAAD888B9DBBB1BF48310F15812ED815AB391D7B4A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 060031B0 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 060033F6

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 97de9533be76e6b2521ad01129bb15380a5fcfdf12246e606411e9098ea618f6
Instruction ID: b9de98460c26020fc4cff41502274f935ad0ea45f744b2667438053b87de5f2a
Opcode Fuzzy Hash: 97de9533be76e6b2521ad01129bb15380a5fcfdf12246e606411e9098ea618f6
Instruction Fuzzy Hash: 8C714670A00B059FE7A8DF6AD44576ABBF1BF88304F10892DD48ADBA50DB75F845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CEF611 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00CEF7AB

Memory Dump Source

Source File: 00000002.00000002.570261312.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_PO_7413.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b4ebcadcf331386598bf59152d22dd6baa0ff115d6bb7db5d0396fcea3f2dc94
Instruction ID: 5b2eba7411e1b34a7368b3f322a4759ab5d42fce42269bb0b60af96bb5ef7e1a
Opcode Fuzzy Hash: b4ebcadcf331386598bf59152d22dd6baa0ff115d6bb7db5d0396fcea3f2dc94
Instruction Fuzzy Hash: 03517770E00258CFDB14CFAAD88479DBBB1BF88300F15802EE819AB391C774A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CEF664 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00CEF7AB

Memory Dump Source

Source File: 00000002.00000002.570261312.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_PO_7413.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a18cf27c033598f6a6599a712b3eb7cf91760c22a2bff1bf9994df4537b81c47
Instruction ID: a293c459aeeff70689d83a52360cbd4b7350193c031f865acadca9f9e1cee105
Opcode Fuzzy Hash: a18cf27c033598f6a6599a712b3eb7cf91760c22a2bff1bf9994df4537b81c47
Instruction Fuzzy Hash: CF5107B5E00258CFDB14CFAAD88879DBBB1BF48314F15812EE815AB391D7B49946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05CFBFB8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.578014228.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5cf0000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2337520b725cb90fee840403b8d561872f83e09b772ecd21c22dfb02f5eb17d8
Instruction ID: 965146cdf70a7734e34c6604c8fa5c8e5e9341117cc4656ff083c86bccd4402a
Opcode Fuzzy Hash: 2337520b725cb90fee840403b8d561872f83e09b772ecd21c22dfb02f5eb17d8
Instruction Fuzzy Hash: 00412272E143898FCB00DBA9D4446EEBFB1BF89310F04856BE409A7250DB789881CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06004B38 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 060057FA

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4310384e9cb65d89a8074d63413c1f7f06219886a2be9c101a10fabc55b01def
Instruction ID: 71ca101db1f6017fc15b656d1d84bad9d85ff4146e8b4c015b748cbffd628926
Opcode Fuzzy Hash: 4310384e9cb65d89a8074d63413c1f7f06219886a2be9c101a10fabc55b01def
Instruction Fuzzy Hash: 715102B1C00309DFEB15CFA9D980ADEBFB5BF48310F24812AE819AB250D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06004B54 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 060057FA

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9b5b22b031c858b0b1b73a77f9380470372e9b16f848ba28c6d2e5338e8323fb
Instruction ID: b393a6bf679c1895a30208aa294f22f2bd10f14ed41a2d21baff8ac93f5a2eac
Opcode Fuzzy Hash: 9b5b22b031c858b0b1b73a77f9380470372e9b16f848ba28c6d2e5338e8323fb
Instruction Fuzzy Hash: 2651C0B1D10309DFEB15CF9AD984ADEBFB5BF48710F24812AE819AB250D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 060056E7 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 060057FA

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 393e9fe2fa2812f0d28f85c510e6a67f7583c49e2bd3c69bcf49bc343b3710f5
Instruction ID: 1dffd27e7ff0a534d5c92ee05f4ba419af430d482ed6e45b355334b4d6562373
Opcode Fuzzy Hash: 393e9fe2fa2812f0d28f85c510e6a67f7583c49e2bd3c69bcf49bc343b3710f5
Instruction Fuzzy Hash: A041EFB1D10309DFEB15CF99D984ADEBFB5BF48310F24812AE819AB250D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CE7584 Relevance: 1.6, APIs: 1, Instructions: 106
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00CE7677

Memory Dump Source

Source File: 00000002.00000002.570261312.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_PO_7413.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 057a1d44202ce7f798845a915ee3efbbb54d5073fcf49620ee4d586abef99abf
Instruction ID: 62d3e7c3f2962d9493ebbe17548432ff6b780da78ace202c5e2522a5c8b0b2de
Opcode Fuzzy Hash: 057a1d44202ce7f798845a915ee3efbbb54d5073fcf49620ee4d586abef99abf
Instruction Fuzzy Hash: FC418CB0D046888FDB10CFAAD88579DBFF5FB48304F10812AE858AB240D7745846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00CE48FC Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00CE7677

Memory Dump Source

Source File: 00000002.00000002.570261312.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_PO_7413.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0578ab3a45ddd83db25ed1639278925b4458dbb1453af53d3f18daeb2c6f7ba2
Instruction ID: 174158e0ee153204aabe4967de5faa692360e8c28c0fac3b7c2b99a747a2bade
Opcode Fuzzy Hash: 0578ab3a45ddd83db25ed1639278925b4458dbb1453af53d3f18daeb2c6f7ba2
Instruction Fuzzy Hash: FB415BB0D047989FDB10CFAAD98579EBBF5EB48304F108129E814AB240D7B49845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06004D0C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0600B571

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f9fc4200b188fd17c3e1dae9863ffce2e872192dcaf8b9d557153d8ec379d5ce
Instruction ID: 9467ee377cbc1df25ed6769ed175353c0487057e0e043994a2ab33186bc743eb
Opcode Fuzzy Hash: f9fc4200b188fd17c3e1dae9863ffce2e872192dcaf8b9d557153d8ec379d5ce
Instruction Fuzzy Hash: 064129B89003058FEB54CF99C488BAABBF5FF88314F248499D419AB360D775E841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CFC0A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 05CFC107

Memory Dump Source

Source File: 00000002.00000002.578014228.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5cf0000_PO_7413.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 366ec51637b53023ab59a97b657ab56b4486d8e5fe011e7e795b7ddf8fd2ce4c
Instruction ID: 64743f1266970fd519d615e52a32932da619736cece1a3b7852a6647b44d8b47
Opcode Fuzzy Hash: 366ec51637b53023ab59a97b657ab56b4486d8e5fe011e7e795b7ddf8fd2ce4c
Instruction Fuzzy Hash: D011DDB1D0062A9FCB10DF9AD544B9EFBF4BB48320F15856AD818A7240D378AA55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 060035F8 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06003662

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a19a41160c02f94ec0844d131fba9684932ea9d3f7122080e377cacda6465d62
Instruction ID: 008e531aaeb27fe02e54837752cc0f85dc436a998b8bc071bb7504cec9c56990
Opcode Fuzzy Hash: a19a41160c02f94ec0844d131fba9684932ea9d3f7122080e377cacda6465d62
Instruction Fuzzy Hash: A411F3B6D003099FDB14CF9AD548ADEFBF4AB48720F14852ED419A7340C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 060035F7 Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06003662

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 42fa2b64fafd50f806fb02c012c5d9741ab2ba98c919061eec47e93ade1e69fe
Instruction ID: 7d6a3d95ca6281282fa025a612a44faed8831e78e2ae437df776956a9483c5ae
Opcode Fuzzy Hash: 42fa2b64fafd50f806fb02c012c5d9741ab2ba98c919061eec47e93ade1e69fe
Instruction Fuzzy Hash: 9B11EFB6D002098FDB14CFAAD588ADEFBF4AB48720F14852AD419A7640C374A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0600D070 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0600DF95

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 05cf99073a9a86d59c90ae58526a679cf6627c04f7c40a534313f41c4ac304fd
Instruction ID: b01a9e234940d537b8e649612968b2d50670cf279d099b3e0116f81eb6a52aba
Opcode Fuzzy Hash: 05cf99073a9a86d59c90ae58526a679cf6627c04f7c40a534313f41c4ac304fd
Instruction Fuzzy Hash: 921133B1D443088FEB60DF9AC548B9EBFF8EB48324F14845AD419A7240C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0600DF3A Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0600DF95

Memory Dump Source

Source File: 00000002.00000002.578400939.0000000006000000.00000040.00000800.00020000.00000000.sdmp, Offset: 06000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6000000_PO_7413.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f7a0a32c5134b968423f5042e64f6af053d0ac2335ee0cbc11681520dd86cb2e
Instruction ID: 5c34d1e6db807fc9072253f8e6411b5024acbbc7f23f7bbf1b83e78deba7bcaa
Opcode Fuzzy Hash: f7a0a32c5134b968423f5042e64f6af053d0ac2335ee0cbc11681520dd86cb2e
Instruction Fuzzy Hash: C81100B5D003088FDB50DF9AD58879EBBF4AB08324F24895AD469B7690D374A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2765fd9ca9fb85553487ef78453fd8d10d21619fa0d8ab2dafc1d6e034ad1348
Instruction ID: 181779bed7d0ab55d6431647b3e294cbe834c33df1c14cf2ffe7ac0e094407be
Opcode Fuzzy Hash: 2765fd9ca9fb85553487ef78453fd8d10d21619fa0d8ab2dafc1d6e034ad1348
Instruction Fuzzy Hash: D921F1B1504240DFDB45CF14D9C0B16BFB5FF88328F24C669E80A0B24AC336D946DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a7e828bec79c03af23556d273a07ba1fb4b576a8287a3930527acb1c69fbba
Instruction ID: a9c127fdb4b8ec2d5afd166497519f684fe6197020ef83960fde0953b07ba852
Opcode Fuzzy Hash: 43a7e828bec79c03af23556d273a07ba1fb4b576a8287a3930527acb1c69fbba
Instruction Fuzzy Hash: E221D372504240EFDB15DF14D9C0B26BF75FF94324F24CAA9E90E1B246C336E856DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569281787.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c8d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80074d6bdf5835dbe621aa5aa1db5d7dc12d04062d191386b61315e103b3630
Instruction ID: 78728557977952f5208bda8743fa28081bc316079ef27c54ca20c43071dbdc4d
Opcode Fuzzy Hash: f80074d6bdf5835dbe621aa5aa1db5d7dc12d04062d191386b61315e103b3630
Instruction Fuzzy Hash: 3D21F575504340DFDB14EF14D9C0B16BB65FB84318F24C969D84A4B286C336D847CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569281787.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c8d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f1a774671815e1961ce028c8a4bc850e4c85256682825b12785a31d166b276
Instruction ID: 98136741002c6ca7df35bf536026d2c7154f16b014f0a551fc104f0a12632774
Opcode Fuzzy Hash: 08f1a774671815e1961ce028c8a4bc850e4c85256682825b12785a31d166b276
Instruction Fuzzy Hash: 7E2180755093C08FDB02DF24D990715BF71EB46314F28C5EAD8898B697C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: 8b92ecff9bf5aaeec3233bcec80ccd28a4f2bd45499fa924abaea11c85145f06
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: 6C11E6B6504280CFCB12CF14D5C4B16BF71FF94324F24C6A9D80A0B656C33AD956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: 8c9656e6d2d614a3c6c0258e6a164182816fe90f6f61db55d577fb1325912f58
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: 2911E676504280DFCB02CF10D5C4B16BF72FF94324F24C6A9D8490B656C33AE956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D629 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7969d067ea76756342fac270451c2567cc879bc5103c71f2adbeeb75c702802
Instruction ID: 3b6c5d9aaa41f60c52c0987f01556de733ebe1af9d1d4a62085d5c8fe0f655d7
Opcode Fuzzy Hash: d7969d067ea76756342fac270451c2567cc879bc5103c71f2adbeeb75c702802
Instruction Fuzzy Hash: EC01F7714093809AE7108A2ADC84766FFE8DF41724F18C85AFD1E1A246C3799984C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.569236857.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c7d000_PO_7413.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807d41bd4f611d74e86d6e2f47b65c560301a5ca0caf5b52cb6416f7a1c30d6e
Instruction ID: 68032b47224cf8b2594dd9f99fe1a224ee7cf937336b42b1b8be364bde52fd8d
Opcode Fuzzy Hash: 807d41bd4f611d74e86d6e2f47b65c560301a5ca0caf5b52cb6416f7a1c30d6e
Instruction Fuzzy Hash: D8F0C2714083449EEB108A06DC84B62FFA8EF51734F18C85AED0D1B286C3799C84CAB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO_7413.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_7413.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Windows Analysis Report
PO_7413.exe

Function 00A9B750 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00A9FDB8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00A93DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00A9536E Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 00A9B978 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00A99538 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00A99930 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00CEF670 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Function 060031B0 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 00CEF611 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Function 00CEF664 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Function 05CFBFB8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Function 06004B38 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Function 06004B54 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 060056E7 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Function 00CE7584 Relevance: 1.6, APIs: 1, Instructions: 106
libraryCOMMON

Function 00CE48FC Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre